Where
-Infinity
0

Trending

Last week
Last month
Last year

libheif libheiflibheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV

Risk 20
Severity
3.7
Integer Overflow
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Last updated 24 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-84449

libheif libheiflibheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed() in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large rangestartoffset and rangesize. The overflow makes the bounds comparison pass and allows heifimagehandledecodeimagetile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.

First published (updated )
CVE-2026-84451

libheif libheiflibheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Last updated 24 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-84447

libheif libheiflibheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Last updated 24 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-84384

libheif libheiflibheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Last updated 24 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-84446

libheif libheiflibheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

Risk 22
Severity
4.3
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Last updated 18 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-62377

libheif libheiflibheif: Out-of-bounds read in uncompressed unci tile range slicing

Risk 47
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 19 August 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-62292

libheif libheiflibheif: Integer underflow in Fraction constructor via double clap transform application

Risk 22
Severity
4.3
Integer Underflow
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Last updated 27 August 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-62289

libheif libheiflibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

Risk 43
Severity
7.5
Infoleak
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

First published (updated )
CVE-2026-47247

libheif libheiflibheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 29 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-49271

libheif libheiflibheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count

Risk 59
Severity
5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-41071

libheif libheiflibheif allows Out-of-bounds vector access leading to invalid dereference (DoS)

Risk 37
Severity
6.5
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-41069

libheif libheiflibheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride

Risk 47
Severity
7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32882

libheif libheiflibheif has a heap buffer overflow in decode_mask_image()

Risk 47
Severity
7.1
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32741

libheif libheiflibheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles

Risk 37
Severity
6.5
Infoleak
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32814

libheif libheiflibheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

Risk 81
Severity
8.8
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32740

libheif libheiflibheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32739

libheif libheiflibheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk

Risk 37
Severity
6.5
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32738

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203